@cosmoops/connect-sdk 0.6.0 → 0.9.0

package/dist/esm/server/http.js

@@ -40,7 +40,7 @@ function parseRetryAfterMs(response) {
     return Number.isFinite(seconds) ? Math.max(0, seconds) * 1000 : null;
 }
 /**
- * Both error dialects, one shape. `/api/v1/service/*` answers
+ * Both error dialects, one shape. `/api/v1/application/*` answers
  * `{ error: { code, message } }`; the `/sso/*` endpoints answer OAuth2's
  * `{ error, error_description }`.
  */
@@ -124,33 +124,55 @@ export async function request(options, spec) {
             // request for minutes.
             await sleep(Math.min(lastError?.retryAfterMs ?? 250 * 2 ** (attempt - 1), 8_000));
         }
-        const timeout = AbortSignal.timeout(options.timeoutMs);
-        const signal = spec.signal ? AbortSignal.any([spec.signal, timeout]) : timeout;
-        let response;
+        // A cancellable timer rather than `AbortSignal.timeout`, because the
+        // timeout has to be *stopped* once this attempt is done reading - and a
+        // timeout signal cannot be cleared.
+        //
+        // That distinction is the whole point for a streaming endpoint. `fetch`
+        // resolves the moment the headers land, but its signal keeps governing
+        // the body: an `AbortSignal.timeout(20_000)` handed to `ai.chat` tears the
+        // SSE stream down mid-answer, twenty seconds in, on every conversation
+        // long enough to matter. Clearing the timer in `finally` bounds the
+        // request the same way it always did (a `raw` caller still gets its
+        // timeout on *reaching* Connect, and a JSON caller still gets it across
+        // the body read, which happens inside the `try`) while leaving a stream
+        // that has actually started to run as long as it needs. A caller that
+        // wants to bound the stream itself passes `spec.signal`.
+        const timeoutController = new AbortController();
+        const timer = setTimeout(() => timeoutController.abort(), options.timeoutMs);
+        const signal = spec.signal
+            ? AbortSignal.any([spec.signal, timeoutController.signal])
+            : timeoutController.signal;
         try {
-            response = await options.fetch(url.toString(), { method: spec.method, headers, body, signal });
+            let response;
+            try {
+                response = await options.fetch(url.toString(), { method: spec.method, headers, body, signal });
+            }
+            catch (cause) {
+                // A caller-supplied abort is a decision, not a fault - never retried.
+                if (spec.signal?.aborted)
+                    throw cause;
+                lastError = new ConnectError({
+                    status: 0,
+                    code: "network_error",
+                    message: `${endpoint} could not reach Connect`,
+                    endpoint,
+                    cause,
+                });
+                continue;
+            }
+            if (response.ok) {
+                if (spec.raw)
+                    return response;
+                return (await readBody(response));
+            }
+            lastError = toConnectError(response, await readBody(response), endpoint);
+            if (!RETRYABLE_STATUS.has(response.status))
+                throw lastError;
         }
-        catch (cause) {
-            // A caller-supplied abort is a decision, not a fault - never retried.
-            if (spec.signal?.aborted)
-                throw cause;
-            lastError = new ConnectError({
-                status: 0,
-                code: "network_error",
-                message: `${endpoint} could not reach Connect`,
-                endpoint,
-                cause,
-            });
-            continue;
+        finally {
+            clearTimeout(timer);
         }
-        if (response.ok) {
-            if (spec.raw)
-                return response;
-            return (await readBody(response));
-        }
-        lastError = toConnectError(response, await readBody(response), endpoint);
-        if (!RETRYABLE_STATUS.has(response.status))
-            throw lastError;
     }
     throw lastError;
 }

package/dist/esm/server/resources/access.js

@@ -1,5 +1,5 @@
 import { pathSegment, request } from "../http.js";
-/** What a signed-in member may do on your service, and the role catalog behind it. */
+/** What a signed-in member may do on your application, and the role catalog behind it. */
 export class AccessResource {
     transport;
     constructor(transport) {
@@ -14,10 +14,10 @@ export class AccessResource {
         return request(this.transport, {
             method: "GET",
             path: `/rbac/users/${pathSegment(userId, "userId")}/roles`,
-            query: { organizationId: input.organizationId },
+            query: { workspaceId: input.workspaceId },
         });
     }
-    /** Your service's own permission catalog and role definitions - the definitions `getUserRoles` resolves against. */
+    /** Your application's own permission catalog and role definitions - the definitions `getUserRoles` resolves against. */
     listRoles() {
         return request(this.transport, { method: "GET", path: "/roles" });
     }

package/dist/esm/server/resources/ai.js

@@ -1,5 +1,5 @@
 import { request } from "../http.js";
-/** RAG chat and structured extraction against an organization's data. */
+/** RAG chat and structured extraction against a workspace's data. */
 export class AiResource {
     transport;
     constructor(transport) {

package/dist/esm/server/resources/analytics.js

@@ -1,9 +1,9 @@
 import { request } from "../http.js";
 /**
- * Your service's own analytics: emit product events, and read back the daily
+ * Your application's own analytics: emit product events, and read back the daily
  * numbers Connect aggregates from them.
  *
- * There is no way to name a service in either call. The scope is always the one
+ * There is no way to name an application in either call. The scope is always the one
  * your API key belongs to - that is the endpoint's security model, not an
  * omission.
  */

package/dist/esm/server/resources/apps.js

@@ -1,5 +1,5 @@
 import { request } from "../http.js";
-/** The services an organization can open - the data behind a launcher grid. */
+/** The applications a workspace can open - the data behind a launcher grid. */
 export class AppsResource {
     transport;
     constructor(transport) {
@@ -7,13 +7,13 @@ export class AppsResource {
     }
     /**
      * Launchable apps only, so a grid tile is never a dead end. The calling
-     * service is included and flagged `isCurrent` rather than filtered out.
+     * application is included and flagged `isCurrent` rather than filtered out.
      */
-    async list(organizationId) {
+    async list(workspaceId) {
         const result = await request(this.transport, {
             method: "GET",
             path: "/apps",
-            query: { organizationId },
+            query: { workspaceId },
         });
         // `?? []` for the same reason `billing.listPlans` has it: this is a
         // collection every caller immediately maps or measures, and a body without

package/dist/esm/server/resources/billing.js

@@ -7,7 +7,7 @@ export class BillingResource {
         this.transport = transport;
     }
     /**
-     * Your service's active plans - render live pricing instead of hardcoding it.
+     * Your application's active plans - render live pricing instead of hardcoding it.
      *
      * `features` is normalised on the way out: Connect used to send bare keys
      * and now sends `{ key, name, description }`, and this SDK is versioned
@@ -25,7 +25,7 @@ export class BillingResource {
         };
     }
     /**
-     * What is left of every consumable add-on on an organization's
+     * What is left of every consumable add-on on a workspace's
      * subscription - the read half of `consumeAddon`.
      *
      * Needs a key scoped to `addons:read`, which is separate from
@@ -35,10 +35,10 @@ export class BillingResource {
      * Returns an empty `addons` array rather than throwing when there is
      * nothing to meter, so a caller can render it unconditionally.
      */
-    async getAddonUsage(organizationId) {
+    async getAddonUsage(workspaceId) {
         const response = await request(this.transport, {
             method: "GET",
-            path: `/addons/organizations/${pathSegment(organizationId, "organizationId")}`,
+            path: `/addons/workspaces/${pathSegment(workspaceId, "workspaceId")}`,
         });
         // Normalised, not passed through: the promise above resolves for any 2xx,
         // and `ConnectUsageMeter` reads `addons` straight off it. A body without
@@ -49,7 +49,7 @@ export class BillingResource {
     }
     /**
      * Debit a consumable add-on's per-cycle balance on behalf of an
-     * organization's users. Call it at whatever cadence your usage happens.
+     * workspace's users. Call it at whatever cadence your usage happens.
      *
      * An `Idempotency-Key` is always sent, generated per call when you do not
      * supply one: a balance cannot be un-spent, so a retried consume without a

package/dist/esm/server/resources/drive.js

@@ -1,5 +1,5 @@
 import { pathSegment, request } from "../http.js";
-/** Files in an organization's Drive - upload, and signed URLs to read back. */
+/** Files in a workspace's Drive - upload, and signed URLs to read back. */
 export class DriveResource {
     transport;
     constructor(transport) {
@@ -9,7 +9,7 @@ export class DriveResource {
         const form = new FormData();
         const fileName = input.fileName ?? input.file.name ?? "upload";
         form.set("file", input.file, fileName);
-        form.set("organizationId", input.organizationId);
+        form.set("workspaceId", input.workspaceId);
         if (input.parentId)
             form.set("parentId", input.parentId);
         return request(this.transport, { method: "POST", path: "/drive/files", multipart: form });
@@ -19,7 +19,7 @@ export class DriveResource {
         const result = await request(this.transport, {
             method: "GET",
             path: `/drive/files/${pathSegment(fileId, "fileId")}/url`,
-            query: { organizationId: input.organizationId },
+            query: { workspaceId: input.workspaceId },
         });
         return result.url;
     }
@@ -28,7 +28,7 @@ export class DriveResource {
         const result = await request(this.transport, {
             method: "GET",
             path: `/drive/files/${pathSegment(fileId, "fileId")}/preview-url`,
-            query: { organizationId: input.organizationId, size: input.size },
+            query: { workspaceId: input.workspaceId, size: input.size },
         });
         return result.url;
     }

package/dist/esm/server/resources/entitlements.js

@@ -9,7 +9,7 @@ export class EntitlementsResource {
         this.transport = transport;
     }
     /**
-     * Every gate Connect owns between an organization and your service -
+     * Every gate Connect owns between a workspace and your application -
      * subscription, KYC/KYB, a chargeable payment method, seat headroom -
      * resolved in one call.
      *
@@ -17,17 +17,17 @@ export class EntitlementsResource {
      * Connect screen that fixes it, so you can route them somewhere useful
      * instead of refusing them with nowhere to go.
      */
-    getReadiness(organizationId) {
+    getReadiness(workspaceId) {
         return request(this.transport, {
             method: "GET",
-            path: `/onboarding/organizations/${pathSegment(organizationId, "organizationId")}`,
+            path: `/onboarding/workspaces/${pathSegment(workspaceId, "workspaceId")}`,
         });
     }
     /** The live plan and subscription, including `plan.features`. */
-    getSubscription(organizationId) {
+    getSubscription(workspaceId) {
         return request(this.transport, {
             method: "GET",
-            path: `/subscriptions/organizations/${pathSegment(organizationId, "organizationId")}`,
+            path: `/subscriptions/workspaces/${pathSegment(workspaceId, "workspaceId")}`,
         });
     }
     /**
@@ -38,8 +38,49 @@ export class EntitlementsResource {
      * all: "not entitled" is the same answer either way, and a feature gate
      * should not need a try/catch around it.
      */
-    async hasFeature(organizationId, feature) {
-        const result = await this.getSubscription(organizationId);
+    async hasFeature(workspaceId, feature) {
+        const result = await this.getSubscription(workspaceId);
         return result.hasActiveSubscription && (result.plan?.features.includes(feature) ?? false);
     }
+    /**
+     * One page of the workspaces subscribed to your application, newest first.
+     *
+     * The inverse of `getSubscription`, which asks about one workspace you
+     * already know. This asks who your subscribers *are* - what a partner
+     * dashboard, an MRR total or a churn report is built on.
+     *
+     * Rate-limited far more tightly than the per-workspace read (10/min per
+     * key, against 60): it walks your whole subscriber base and is a reporting
+     * call, not a per-request gate. Use `getSubscription` in a hot path.
+     *
+     * Your application is resolved from the API key, so there is no parameter
+     * for it and no way to ask about anyone else's.
+     */
+    listSubscribers(options = {}) {
+        return request(this.transport, {
+            method: "GET",
+            path: "/subscriptions",
+            query: { status: options.status, before: options.before, limit: options.limit },
+        });
+    }
+    /**
+     * Every subscriber, paged through for you.
+     *
+     * An async generator rather than an array: a large subscriber base is
+     * exactly where an accidental full materialisation hurts, and `for await`
+     * reads the same as a loop over one page.
+     */
+    async *iterateSubscribers(options = {}) {
+        let before;
+        do {
+            const page = await this.listSubscribers({
+                status: options.status,
+                limit: options.pageSize,
+                before,
+            });
+            for (const item of page.items)
+                yield item;
+            before = page.nextBefore ?? undefined;
+        } while (before);
+    }
 }

package/dist/esm/server/resources/identity.js

@@ -66,7 +66,8 @@ export class IdentityResource {
             sessionTokenExpiresIn: wire.session_token_expires_in,
             user: wire.user,
             subscription: wire.subscription,
-            serviceRole: wire.serviceRole,
+            applicationRole: wire.applicationRole,
+            audience: wire.audience,
         };
     }
     /**
@@ -136,7 +137,8 @@ export class IdentityResource {
         return {
             user: wire.user,
             subscription: wire.subscription,
-            serviceRole: wire.serviceRole,
+            applicationRole: wire.applicationRole,
+            audience: wire.audience,
             sessionExpiresAt: wire.session_expires_at,
         };
     }
@@ -145,7 +147,7 @@ export class IdentityResource {
      * rest of its ~15-day life. Discard your own copy of `sessionToken` too;
      * this does not do that for you.
      *
-     * `scope` defaults to `"device"`: this sign-in, every other service signed
+     * `scope` defaults to `"device"`: this sign-in, every other application signed
      * into from the same browser, and Connect's own session on that one device.
      * `"all"` ends every session on every device - an explicit "sign out
      * everywhere" action only.
@@ -177,7 +179,7 @@ export class IdentityResource {
             throw new ConnectError({
                 status: 0,
                 code: "missing_client_id",
-                message: "identity.* needs `clientId`. Pass it to `new ConnectClient({ clientId, apiKey })` - it is shown in this service's Integration tab, under Connect client.",
+                message: "identity.* needs `clientId`. Pass it to `new ConnectClient({ clientId, apiKey })` - it is shown in this application's Integration tab, under Connect client.",
                 endpoint: "identity",
             });
         }

package/dist/esm/server/resources/integrations.js

@@ -1,8 +1,8 @@
 import { request } from "../http.js";
 /**
  * Composio-hosted third-party connections (Google Calendar, Slack,
- * Twitter/X, ...) an organization has connected. Connect proxies every call
- * here - your service never sees or holds the underlying OAuth token, which
+ * Twitter/X, ...) a workspace has connected. Connect proxies every call
+ * here - your application never sees or holds the underlying OAuth token, which
  * stays with Composio.
  */
 export class IntegrationsResource {
@@ -10,12 +10,12 @@ export class IntegrationsResource {
     constructor(transport) {
         this.transport = transport;
     }
-    /** Enabled toolkits and this organization's connection status for each. */
-    async list(organizationId) {
+    /** Enabled toolkits and this workspace's connection status for each. */
+    async list(workspaceId) {
         const result = await request(this.transport, {
             method: "GET",
             path: "/integrations",
-            query: { organizationId },
+            query: { workspaceId },
         });
         // `?? []` for the same reason `AppsResource.list` has it - a collection
         // every caller immediately maps or measures.
@@ -32,31 +32,31 @@ export class IntegrationsResource {
      * itself. Reconnecting a disconnected/failed toolkit calls this same
      * method - there is no separate reconnect.
      *
-     * Meant to be called on behalf of a signed-in org admin (this is what the
+     * Meant to be called on behalf of a signed-in workspace admin (this is what the
      * bridge's fixed `POST /integrations/connect` route does), not as a bare
      * background action with no admin present to complete the OAuth screen.
      */
-    async initiateConnect(organizationId, toolkitSlug, returnUrl) {
+    async initiateConnect(workspaceId, toolkitSlug, returnUrl) {
         return request(this.transport, {
             method: "POST",
             path: "/integrations/connect",
-            json: { organizationId, toolkitSlug, returnUrl },
+            json: { workspaceId, toolkitSlug, returnUrl },
         });
     }
     /** Idempotent - disconnecting a toolkit that was never connected, or is already disconnected, is a success. */
-    async disconnect(organizationId, toolkitSlug) {
+    async disconnect(workspaceId, toolkitSlug) {
         return request(this.transport, {
             method: "POST",
             path: "/integrations/disconnect",
-            json: { organizationId, toolkitSlug },
+            json: { workspaceId, toolkitSlug },
         });
     }
-    /** Calls a Composio action against this organization's connected account for the named toolkit. */
-    async execute(organizationId, input) {
+    /** Calls a Composio action against this workspace's connected account for the named toolkit. */
+    async execute(workspaceId, input) {
         return request(this.transport, {
             method: "POST",
             path: "/integrations/actions/execute",
-            json: { organizationId, ...input },
+            json: { workspaceId, ...input },
         });
     }
 }

package/dist/esm/server/resources/logs.js

@@ -1,5 +1,5 @@
 import { request } from "../http.js";
-/** Push feature events into the Console's audit log, filterable to your service. */
+/** Push feature events into the Console's audit log, filterable to your application. */
 export class LogsResource {
     transport;
     constructor(transport) {
@@ -11,9 +11,9 @@ export class LogsResource {
      * reported through the return value.
      *
      * Pass `sessionToken` to attribute the event to the end user it belongs to.
-     * Both scopes on the stored entry come from something verified - the service
+     * Both scopes on the stored entry come from something verified - the application
      * from your API key, the user from that token, which Connect checks was
-     * minted for your service before attributing anything. `attributed` in the
+     * minted for your application before attributing anything. `attributed` in the
      * result says whether it resolved; a `false` there still means the line was
      * stored, just without a user on it.
      */

package/dist/esm/server/resources/sessions.js

@@ -5,11 +5,11 @@ import { request } from "../http.js";
  * timestamps - the same list Connect's own account settings page shows the
  * user themselves.
  *
- * **Account-wide, not scoped to this service.** A Connect session is one
- * browser's login to Connect, and it fans out to every partner service's own
- * `sessionToken` - Connect has no per-service session concept to filter by.
+ * **Account-wide, not scoped to this application.** A Connect session is one
+ * browser's login to Connect, and it fans out to every partner application's own
+ * `sessionToken` - Connect has no per-application session concept to filter by.
  * `list()` returns every session on the account, including ones that
- * originated from a completely different, unrelated service. Requires the
+ * originated from a completely different, unrelated application. Requires the
  * `sessions:manage` scope on your API key - unlike `identity`'s base `sso`
  * capability, this is never granted to a zero-scope legacy key by default.
  *
@@ -35,7 +35,7 @@ export class SessionsResource {
     }
     /**
      * Ends one specific session by id - not necessarily the one `sessionToken`
-     * itself was minted from. Cascades to every partner-service sign-in that
+     * itself was minted from. Cascades to every partner-application sign-in that
      * originated from that same browser, same as Connect's own "sign out this
      * device".
      */
@@ -69,7 +69,7 @@ export class SessionsResource {
             throw new ConnectError({
                 status: 0,
                 code: "missing_client_id",
-                message: "sessions.* needs `clientId`. Pass it to `new ConnectClient({ clientId, apiKey })` - it is shown in this service's Integration tab, under Connect client.",
+                message: "sessions.* needs `clientId`. Pass it to `new ConnectClient({ clientId, apiKey })` - it is shown in this application's Integration tab, under Connect client.",
                 endpoint: "sessions",
             });
         }

package/dist/esm/server/webhooks.js

@@ -54,10 +54,10 @@ export function verifyConnectWebhook(rawBody, signatureHeader, secret, now = new
  * export const POST = createConnectWebhookHandler({
  *   secret: process.env.CONNECT_WEBHOOK_SECRET!,
  *   on: {
- *     "organization.deletion_scheduled": ({ organizationId, purgeAfter }) =>
- *       freeze(organizationId, purgeAfter),
- *     "organization.deletion_cancelled": ({ organizationId }) => unfreeze(organizationId),
- *     "organization.deleted": ({ organizationId }) => purge(organizationId),
+ *     "workspace.deletion_scheduled": ({ workspaceId, purgeAfter }) =>
+ *       freeze(workspaceId, purgeAfter),
+ *     "workspace.deletion_cancelled": ({ workspaceId }) => unfreeze(workspaceId),
+ *     "workspace.deleted": ({ workspaceId }) => purge(workspaceId),
  *   },
  * })
  * ```

package/dist/esm/types.js

@@ -1,5 +1,5 @@
 /**
- * Wire types for the `/api/v1/service/*` surface - the service-partner API,
+ * Wire types for the `/api/v1/application/*` surface - the application-partner API,
  * and the only thing this SDK covers.
  *
  * Hand-written rather than generated so the published package carries no

package/dist/theme.css

@@ -110,3 +110,90 @@ body {
   background: var(--background);
   color: var(--foreground);
 }
+
+/* ---------------------------------------------------------------------------
+ * Ask AI: Streamdown token compatibility.
+ *
+ * `ConnectAskAi` renders markdown with Streamdown, which paints using
+ * shadcn/ui's token names. HeroUI defines a different set - four happen to line
+ * up already (`--background`, `--foreground`, `--border`, `--radius`), and the
+ * rest are aliased here so an answer inherits the platform's own theme instead
+ * of rendering with missing backgrounds and borders.
+ *
+ * This lives in the shipped theme rather than in each partner's CSS because it
+ * is a fact about how these two libraries name colours, not a design choice
+ * anyone should have to rediscover.
+ *
+ * Additive - HeroUI uses none of these names - with exactly one real collision,
+ * handled below.
+ * ------------------------------------------------------------------------ */
+:root,
+.light,
+.default,
+[data-theme="light"],
+[data-theme="default"],
+.dark,
+[data-theme="dark"] {
+  --card: var(--surface);
+  --card-foreground: var(--surface-foreground);
+  --input: var(--border);
+  --primary: var(--accent);
+  --primary-foreground: var(--accent-foreground);
+}
+
+/* ---------------------------------------------------------------------------
+ * The collision: `--muted` is a *surface* in shadcn (code-block fills, table
+ * header rows) and a *text colour* in HeroUI. Reading it as HeroUI's would
+ * paint every code block mid-grey and leave the text on it unreadable.
+ *
+ * So it is shadowed - but only inside the answer body, and only after the host
+ * element has captured HeroUI's value under shadcn's name for it. Splitting it
+ * across two elements is what makes this safe: `--muted-foreground` is computed
+ * on `.connect-ai-host`, where `--muted` still means HeroUI's text grey, and
+ * inherits that resolved colour downward. Both declarations on one element
+ * would resolve `var(--muted)` against the new value and lose the original.
+ * ------------------------------------------------------------------------ */
+.connect-ai-host {
+  --muted-foreground: var(--muted);
+}
+
+.connect-ai-host .connect-ai-body {
+  --muted: var(--surface-secondary);
+}
+
+/* ---------------------------------------------------------------------------
+ * The Ask AI "thinking" shimmer - a highlight sweeping through the label while
+ * the model works, rather than a spinner.
+ *
+ * A gradient clipped to the glyphs, so the motion is *in* the word instead of
+ * beside it. This is the one state where the panel has nothing at all to show:
+ * retrieval and the model's first thought take a second or two, and a static
+ * "Thinking" reads as frozen.
+ * ------------------------------------------------------------------------ */
+.connect-ai-shimmer {
+  background: linear-gradient(100deg, var(--muted) 32%, var(--accent) 48%, var(--muted) 64%);
+  background-size: 220% 100%;
+  -webkit-background-clip: text;
+  background-clip: text;
+  color: transparent;
+  animation: connect-ai-shimmer 1.7s linear infinite;
+}
+
+@keyframes connect-ai-shimmer {
+  from {
+    background-position: 180% 0;
+  }
+  to {
+    background-position: -40% 0;
+  }
+}
+
+/* Motion is the whole affordance here, so with it suppressed the label has to
+   go back to being a legible static word rather than a transparent one. */
+@media (prefers-reduced-motion: reduce) {
+  .connect-ai-shimmer {
+    background: none;
+    color: var(--muted);
+    animation: none;
+  }
+}

package/dist/types/client/components/access-gate.d.ts

@@ -3,8 +3,14 @@ import type { ReadinessBlocker } from "../../types.js";
 export type ConnectAccessGateState = "loading"
 /** No signed-in user - not this component's concern, see the doc comment on `ConnectAccessGate`. */
  | "signed_out"
-/** `organization_suspended` - a platform admin took this workspace offline. Hard block, no dismiss. */
+/** `workspace_suspended` - a platform admin took this workspace offline. Hard block, no dismiss. */
  | "suspended"
+/**
+ * `audience_mismatch` - this application serves individual accounts and the
+ * workspace is a business, or the reverse. Hard block with nothing to
+ * offer: `Workspace.type` is fixed at sign-up.
+ */
+ | "audience_mismatch"
 /** `subscription_missing` - nothing to subscribe to yet. Hard block. */
  | "no_subscription"
 /** `onboarding_approval_pending` - waiting on a reviewer. Hard block, no action to offer. */
@@ -33,9 +39,17 @@ export interface ConnectAccessGateResult {
  * `ConnectReadinessGate`/`ConnectReadinessBanner` already use. `ConnectAccessGate`
  * is a priority ordering over the same data, not a second opinion about it.
  *
- * Priority, first match wins: `suspended` > `no_subscription` >
- * `onboarding_pending` > any other blocking code (`blocked`) >
- * `payment_retry` (advisory - `children` still render) > `clear`.
+ * Priority, first match wins: `suspended` > `audience_mismatch` >
+ * `no_subscription` > `onboarding_pending` > any other blocking code
+ * (`blocked`) > `payment_retry` (advisory - `children` still render) >
+ * `clear`.
+ *
+ * `audience_mismatch` outranks `no_subscription` deliberately, and the
+ * ordering is the whole point of it: a workspace of the wrong account type
+ * carries BOTH blockers at once, and showing the subscription one first sent
+ * the customer to a plan picker whose subscribe call
+ * (`ActivateSubscriptionUseCase`) rejects them for the audience anyway. The
+ * account type is the reason; the missing subscription is a consequence.
  */
 export declare function useConnectAccessGate(): ConnectAccessGateResult;
 export interface ConnectAccessGateProps {

package/dist/types/client/components/account-sessions.d.ts

@@ -10,7 +10,7 @@ export interface ConnectAccountSessionsProps {
 }
 /**
  * Every device signed into this Connect account - not scoped to this
- * service, see `ConnectUserSession`'s doc comment. Owns the one
+ * application, see `ConnectUserSession`'s doc comment. Owns the one
  * `useConnectSessions()` call for this modal; every revoke action here
  * mutates through it and re-reads the list itself, since nothing else
  * invalidates it automatically - see `mutateResource`'s doc comment.